Security update for libzypp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0079-1 Final 1 1 2020-09-16T14:17:21Z current 2020-09-16T14:17:21Z 2020-09-16T14:17:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libzypp This update for libzypp fixes the following issues: Security issue fixed: - CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/nginx-ingress-controller:beta1-2020-79,Container suse/sles12sp3:latest-2020-79,Container suse/sles12sp4:latest-2020-79,Container suse/sles12sp5:latest-2020-79,Image SLES12-SP4-Azure-BYOS-2020-79,Image SLES12-SP4-EC2-HVM-BYOS-2020-79,Image SLES12-SP4-GCE-BYOS-2020-79,Image SLES12-SP4-OCI-BYOS-2020-79,Image SLES12-SP4-SAP-Azure-2020-79,Image SLES12-SP4-SAP-Azure-BYOS-2020-79,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-79,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2020-79,Image SLES12-SP4-SAP-EC2-HVM-2020-79,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-79,Image SLES12-SP4-SAP-GCE-2020-79,Image SLES12-SP4-SAP-GCE-BYOS-2020-79,Image SLES12-SP4-SAP-OCI-BYOS-2020-79,Image SLES12-SP5-Azure-BYOS-2020-79,Image SLES12-SP5-Azure-Basic-On-Demand-2020-79,Image SLES12-SP5-Azure-HPC-BYOS-2020-79,Image SLES12-SP5-Azure-HPC-On-Demand-2020-79,Image SLES12-SP5-Azure-SAP-BYOS-2020-79,Image SLES12-SP5-Azure-SAP-On-Demand-2020-79,Image SLES12-SP5-Azure-Standard-On-Demand-2020-79,Image SLES12-SP5-EC2-BYOS-2020-79,Image SLES12-SP5-EC2-ECS-On-Demand-2020-79,Image SLES12-SP5-EC2-On-Demand-2020-79,Image SLES12-SP5-EC2-SAP-BYOS-2020-79,Image SLES12-SP5-EC2-SAP-On-Demand-2020-79,Image SLES12-SP5-GCE-BYOS-2020-79,Image SLES12-SP5-GCE-On-Demand-2020-79,Image SLES12-SP5-GCE-SAP-BYOS-2020-79,Image SLES12-SP5-GCE-SAP-On-Demand-2020-79,Image SLES12-SP5-OCI-BYOS-BYOS-2020-79,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2020-79,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-79,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-79,SUSE-2020-79,SUSE-SLE-DESKTOP-12-SP4-2020-79,SUSE-SLE-SDK-12-SP4-2020-79,SUSE-SLE-SDK-12-SP5-2020-79,SUSE-SLE-SERVER-12-SP4-2020-79,SUSE-SLE-SERVER-12-SP5-2020-79 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200079-1/ Link for SUSE-SU-2020:0079-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006329.html E-Mail link for SUSE-SU-2020:0079-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1158763 SUSE Bug 1158763 https://www.suse.com/security/cve/CVE-2019-18900/ SUSE CVE CVE-2019-18900 page Container caasp/v4/nginx-ingress-controller:beta1 Container suse/sles12sp3:latest Container suse/sles12sp4:latest Container suse/sles12sp5:latest Image SLES12-SP4-Azure-BYOS Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-GCE-BYOS Image SLES12-SP4-OCI-BYOS Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-BYOS Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 libzypp-16.21.2-2.45.1 libzypp-devel-16.21.2-2.45.1 libzypp-devel-doc-16.21.2-2.45.1 libzypp-16.21.2-2.45.1 as a component of Container caasp/v4/nginx-ingress-controller:beta1 libzypp-16.21.2-2.45.1 as a component of Container suse/sles12sp3:latest libzypp-16.21.2-2.45.1 as a component of Container suse/sles12sp4:latest libzypp-16.21.2-2.45.1 as a component of Container suse/sles12sp5:latest libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-Azure-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-GCE-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-OCI-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-Azure libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-EC2-HVM libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-GCE libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-EC2-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-EC2-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-GCE-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-GCE-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libzypp-16.21.2-2.45.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libzypp-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libzypp-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server 12 SP4 libzypp-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 libzypp-devel-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 libzypp-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libzypp-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libzypp-devel-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libzypp-devel-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libzypp-devel-doc-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libzypp-devel-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libzypp-devel-doc-16.21.2-2.45.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1. CVE-2019-18900 Container caasp/v4/nginx-ingress-controller:beta1:libzypp-16.21.2-2.45.1 Container suse/sles12sp3:latest:libzypp-16.21.2-2.45.1 Container suse/sles12sp4:latest:libzypp-16.21.2-2.45.1 Container suse/sles12sp5:latest:libzypp-16.21.2-2.45.1 Image SLES12-SP4-Azure-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-EC2-HVM-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-GCE-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-OCI-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-Azure-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-Azure:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-EC2-HVM:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-GCE-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-GCE:libzypp-16.21.2-2.45.1 Image SLES12-SP4-SAP-OCI-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-Basic-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-HPC-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-HPC-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-SAP-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-SAP-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-Azure-Standard-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-EC2-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-EC2-ECS-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-EC2-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-EC2-SAP-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-EC2-SAP-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-GCE-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-GCE-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-GCE-SAP-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-GCE-SAP-On-Demand:libzypp-16.21.2-2.45.1 Image SLES12-SP5-OCI-BYOS-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:libzypp-16.21.2-2.45.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libzypp-16.21.2-2.45.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Desktop 12 SP4:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Server 12 SP4:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Server 12 SP5:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Server 12 SP5:libzypp-devel-16.21.2-2.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libzypp-16.21.2-2.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libzypp-devel-16.21.2-2.45.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libzypp-devel-16.21.2-2.45.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libzypp-devel-doc-16.21.2-2.45.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libzypp-devel-16.21.2-2.45.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libzypp-devel-doc-16.21.2-2.45.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200079-1/ https://www.suse.com/security/cve/CVE-2019-18900.html CVE-2019-18900 https://bugzilla.suse.com/1158763 SUSE Bug 1158763